Last updated: June 2025

Privacy & Cookies Policy

This policy explains how Epiphany Foster Care collects, uses, and protects your personal information, and how we use cookies on our website. We are committed to being transparent and to protecting your privacy.

Contents

  1. Who we are
  2. What personal data we collect
  3. Why we collect it and our lawful basis
  4. How long we keep your data
  5. Who we share your data with
  6. Your rights under UK GDPR
  7. How we keep your data secure
  8. Cookies policy
  9. Third-party links
  10. Changes to this policy
  11. Contact us & complaints

1. Who we are

Epiphany Foster Care Ltd ("Epiphany", "we", "us", "our") is an independent fostering agency registered with Ofsted and incorporated in England and Wales.

We are the data controller for the personal information we hold about you. This means we are responsible for deciding how and why your personal data is used.

This policy applies to our website at www.epiphanyfostercare.org.uk and to any personal data we hold in the course of our fostering agency activities.

2. What personal data we collect

Information you give us directly

  • Name, email address, phone number, and home address
  • Details about your household and family situation (for fostering enquiries)
  • Information about your employment, health, and personal history (during the assessment process)
  • Organisation name and role (for professionals making referrals)
  • Details about a child being referred (for referral enquiries — this will include special category data)
  • Any message or information you include in our contact forms

Information we collect automatically

  • Your IP address and browser type
  • Pages visited, time spent on the site, and navigation paths
  • Device type and operating system
  • Referring website or search terms (how you found us)
Special category data: During the fostering assessment process, we may collect sensitive personal information including health and medical information, ethnicity, faith, criminal history (DBS), and financial circumstances. We only collect this where it is necessary and with your explicit consent or to meet a legal obligation.

3. Why we collect it and our lawful basis

Under UK GDPR, we must have a lawful basis to process your personal data. The table below sets out the purposes for which we process data and the legal grounds we rely on.

Purpose Data used Lawful basis
Responding to website enquiries and contact form submissions Name, email, phone, message Legitimate interests (responding to your request)
Processing fostering applications and assessments Full personal, family, health, DBS, and financial information Legitimate interests; legal obligation (Fostering Services Regulations 2011); explicit consent for special category data
Processing child referrals from professionals Child's details, needs, placement urgency; referrer's name and organisation Vital interests of the child; legal obligation; public task
Carer support and supervision Carer and placement records Legal obligation; contract performance
Sending service updates and relevant communications to enquirers Name, email Legitimate interests; or consent (where required)
Improving our website and measuring performance Anonymised or pseudonymised analytics data Legitimate interests; consent (for non-essential cookies)
Regulatory compliance and safeguarding obligations All relevant records Legal obligation

4. How long we keep your data

We keep your personal data only for as long as necessary for the purpose it was collected, or as required by law.

Type of data Retention period
Website enquiry contact details (no application made) 12 months from last contact
Unsuccessful fostering applications 3 years from date of decision
Approved carer records 75 years from the date of the last placement, or 15 years after death of carer (whichever is sooner), in line with statutory guidance
Child placement and care records 75 years from the child's date of birth, in line with statutory guidance
Referral records (professional) 7 years after the placement ends, or in line with the placing authority's requirements
Financial and accounting records 6 years from end of financial year
Website analytics data 26 months (aggregated; anonymised thereafter)

5. Who we share your data with

We do not sell your personal data to third parties. We only share data where it is necessary to deliver our services or to comply with legal obligations.

  • Placing local authorities — when matching and managing placements, as required by the Fostering Services Regulations 2011.
  • Ofsted and regulatory bodies — in the course of inspection and regulatory compliance.
  • DBS (Disclosure and Barring Service) — for mandatory background checks on prospective carers and staff.
  • Health professionals and CAMHS — to support the wellbeing of children in our care, where the child's interests require it.
  • Legal advisors and solicitors — where required in connection with immigration or care proceedings.
  • IT and cloud service providers — including our website hosting provider and secure email system, who process data only under our instruction and are contractually bound to protect it.
  • Our Fostering Panel — independent panel members appointed to assess carer applications in accordance with regulations.

All third parties with whom we share personal data are required to keep it confidential and secure, and to process it only for the specified purpose.

We do not transfer your personal data outside of the UK or the European Economic Area (EEA) unless adequate safeguards are in place and we have a lawful basis to do so.

6. Your rights under UK GDPR

You have the following rights in relation to your personal data. Please note that some rights are not absolute and may be subject to limitations or exemptions.

  • Right of access — You can request a copy of the personal data we hold about you (a Subject Access Request).
  • Right to rectification — You can ask us to correct inaccurate or incomplete data.
  • Right to erasure — In certain circumstances, you can ask us to delete your personal data ("the right to be forgotten").
  • Right to restrict processing — You can ask us to limit how we use your data in certain circumstances.
  • Right to data portability — Where processing is based on consent or contract and carried out by automated means, you can ask us to transfer your data to you or a third party in a machine-readable format.
  • Right to object — You have the right to object to processing based on legitimate interests, and to direct marketing.
  • Rights related to automated decision-making — We do not make automated decisions about you that produce significant legal effects.
  • Right to withdraw consent — Where we rely on consent to process your data, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before withdrawal.
To exercise any of your rights, please contact us at info@epiphanyfostercare.org.uk or by post to our registered address. We will respond within one month of receiving your request (or within three months for complex requests).

7. How we keep your data secure

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your information from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

  • Encryption of data in transit (TLS/HTTPS) and at rest where applicable
  • Access controls ensuring only authorised staff can access personal data
  • Secure, password-protected systems and devices
  • Regular staff training on data protection and confidentiality
  • Incident response procedures to detect and report data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, notify affected individuals without undue delay.

8. Cookies policy

This website uses cookies in accordance with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR. A cookie is a small text file placed on your device when you visit a website.

Cookie categories

Strictly necessary
Functional
Analytics
Marketing
Cookie name Category Purpose Duration
efc_cookie_consent Strictly necessary Stores your cookie consent preference so we don't ask on every visit 12 months
efc_session Strictly necessary Maintains your session state while you use the website (e.g. form submissions) Session (deleted on browser close)
_ga Analytics Google Analytics — distinguishes unique users 2 years
_ga_* Analytics Google Analytics — maintains session state for analytics 2 years
_gid Analytics Google Analytics — distinguishes users within 24 hours 24 hours

Strictly necessary cookies

These cookies are essential for the website to function and cannot be switched off. They are set in response to actions you take, such as completing a form. You can set your browser to block these cookies, but parts of the website may not function correctly.

Analytics cookies

We use Google Analytics to understand how visitors use our website, which pages are popular, and how people find us. This helps us improve our service. Analytics cookies are only placed on your device if you consent. The data collected is anonymised and aggregated — it does not identify you personally. You can opt out at any time by installing the Google Analytics opt-out browser add-on.

Managing your cookies

You can change your cookie preferences at any time by clicking "Manage cookies" at the bottom of any page, or by adjusting your browser settings. Most browsers allow you to refuse, delete, or control cookies. Please note that disabling certain cookies may affect the functionality of this website.

For more information about cookies generally, visit www.allaboutcookies.org.

9. Third-party links

Our website may contain links to external websites operated by third parties (for example, Ofsted, government services, or legal organisations). We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal information.

10. Changes to this policy

We may update this Privacy and Cookies Policy from time to time to reflect changes in the law, our practices, or the way our website operates. We will publish the updated policy on this page with a revised "Last updated" date. Where changes are significant, we may also notify you by email.

We encourage you to review this policy periodically.

11. Contact us & complaints

If you have any questions about this policy, want to exercise your data rights, or have a concern about how we handle your personal information, please contact us:

If you are not satisfied with our response, or believe we are processing your personal data in a way that does not comply with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):